Entropy source with magneto-resistive element for random number generator

ABSTRACT

An entropy source and a random number (RN) generator are disclosed. In one aspect, a low-energy entropy source includes a magneto-resistive (MR) element and a sensing circuit. The MR element is applied a static current and has a variable resistance determined based on magnetization of the MR element. The sensing circuit senses the resistance of the MR element and provides random values based on the sensed resistance of the MR element. In another aspect, a RN generator includes an entropy source and a post-processing module. The entropy source includes at least one MR element and provides first random values based on the at least one MR element. The post-processing module receives and processes the first random values (e.g., based on a cryptographic hash function, an error detection code, a stream cipher algorithm, etc.) and provides second random values having improved randomness characteristics.

The present application is a divisional of U.S. application Ser. No.13/367,322, entitled “ENTROPY SOURCE WITH MAGNETO-RESISTIVE ELEMENT FORRANDOM NUMBER GENERATOR,” filed Feb. 6, 2012, and claims priority toprovisional U.S. Application Ser. No. 61/536,769, entitled “ENTROPYSOURCE WITH STT-MTJ SEMICONDUCTOR DEVICE FOR RANDOM NUMBER GENERATOR,”filed Sep. 20, 2011, and incorporated herein by reference in itsentirety.

BACKGROUND

I. Field

The present disclosure relates generally to electronics circuits, andmore specifically to techniques for generating random values.

II. Background

Random number (RN) generators are widely used to generate random valuesfor various applications. For example, a computer-like device thatimplements a cryptographic security algorithm typically needs a sourceof random values (usually random binary bits). A RN generator may beused to provide random values to the computer-like device for thecryptographic security algorithm. A RN generator is also commonlyreferred to as a RNG or a random bit generator (RBG).

A RN generator may be implemented with an entropy source that canprovide a sequence of random bits. The entropy source may be implementedwith a physical device having state transitions that can be modeled by asimple first-order Markov process to the most extent, so that entropyquality and related security strength can be more easily quantified toensure sufficient security strength. Random bits may be derived from asequence of state transitions of the physical device. However, mostphysical devices that can be used for an entropy source are expensive,require high power, and generate data slowly. Furthermore, it may bedifficult or impractical to model the state transitions of thesephysical devices as simple Markov process, which may make it moredifficult to quantify the performance of the physical devices.

SUMMARY

An entropy source and a RN generator that can generate random valuesbased on one or more magneto-resistive (MR) elements are describedherein. In one aspect, a low-energy entropy source may include a MRelement and a sensing circuit. The MR element may be applied a staticcurrent (and no current pulses) and may have a variable resistancedetermined based on magnetization of the MR element. A static current isa current of constant amplitude and polarity, e.g., no current pulses.The MR element may spontaneously and randomly transition betweendifferent magnetization states, and these transitions may affect theresistance of the MR element. The sensing circuit may sense theresistance of the MR element and provide random values based on thesensed resistance of the MR element.

In another aspect, a RN generator may include an entropy source and apost-processing module. The entropy source may include at least one MRelement and may provide first random values based on the at least one MRelement. The post-processing module may receive and process the firstrandom values (e.g., based on a cryptographic hash function, an errordetection code, a stream cipher algorithm, etc.) and provide secondrandom values having improved randomness characteristics.

In yet another aspect, an entropy source may include an array of MRcells and a sensing circuit. The array of MR cells may be arranged in aplurality of rows and a plurality of columns. Each MR cell may compriseat least one MR element. A plurality of word lines may be coupled to theplurality of rows of MR cells. A plurality of select lines may becoupled to the plurality of columns of MR cells. A plurality of bitlines may also be coupled to the plurality of columns of MR cells. Thesensing circuit may be coupled to the plurality of select lines and maysense the resistance of the MR cells in the array. The MR cells in thearray may be selected (e.g., in an interleaved manner) and sensed at afirst rate to generate random values at a second rate, which may behigher than the first rate.

In yet another aspect, a tamper detection module may include an entropysource and a detection module. The entropy source may include at leastone MR element and may provide first values based on the at least one MRelement. The detection module may receive and process the first valuesand provide an indication of tampering with the entropy source. Thedetection module may detect tampering with the entropy source based onvarious criteria such as percentage of zeros and percentage of ones inthe first values, or runs of zeros and runs of ones in the first values,or the number of occurrences of predetermined patterns of zeros and onesin the first values, or an output rate of compression of the firstvalues, etc.

Various aspects and features of the disclosure are described in furtherdetail below.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a block diagram of a RN generator.

FIGS. 2A and 2B show two designs of a low-energy entropy source.

FIG. 3 shows a design of a high-energy entropy source.

FIG. 4 shows a process performed by a control circuit in FIG. 3.

FIG. 5 shows a design of an entropy source with an array of MR cells.

FIGS. 6A, 6B and 6C show three designs of a MR cell.

FIGS. 7A to 12 show various designs of a RN generator.

FIG. 13 shows a tamper detection circuit.

FIG. 14 shows a process for generating random values.

FIG. 15 shows a block diagram of a wireless device.

DETAILED DESCRIPTION

An entropy source and a RN generator that can generate random valuesbased on one or more MR elements are disclosed herein. A MR element isan element having a resistance that changes with its magnetization. A MRelement may be a magnetic tunnel junction (MTJ) semiconductor device, aspin torque transfer magnetic tunnel junction (STT-MTJ) semiconductordevice, or some other device with variable resistance versusmagnetization. A STT-MTJ device is a MTJ device that isprogrammed/written by passing a current through the device (instead ofprogrammed with magnetic field like other MTJ devices). The use of a MRelement (e.g., a STT-MTJ device) for an entropy source may providecertain advantages such as ease of fabrication, low cost, goodperformance, and ability to quantify entropy and security strength.

An entropy source and a RN generator may be used for various electronicsdevices such as wireless devices, cellular phones, smart phones,tablets, personal digital assistants (PDAs), laptop computers, desktopcomputers, netbooks, smartbooks, etc. An entropy source and a RNgenerator may also be used for various applications such ascryptography, a noise source (e.g., for test equipment), sequencegeneration for probabilistic logic (e.g., sequences representingstochastic variables), Monte-Carlo simulations, optimization problems,genetic algorithms, etc.

FIG. 1 shows a block diagram of a design of a RN generator 100. In thisdesign, RN generator 100 includes an entropy source 110 and apost-processing module 120. Entropy source 110 includes one or more MRelements (e.g., one or more STT-MTJ devices) and generates first randomvalues, which may be random bits of ‘1’ or ‘0’. The terms “random” and“unpredictable” may be used interchangeably. In the design shown in FIG.1, post-processing module 120 receives the first random values fromentropy source 110 and generates second random values that more closelymatch (statistically) the random values from a true random source. Thepost-processing by module 120 may improve randomness properties. Thesecond random values may be binary values or non-binary values. Inanother design that is not shown in FIG. 1, the first random values maybe provided directly as the second random values without anypost-processing. In this design, the RN generator would include onlyentropy source 110.

In one aspect, a low-energy entropy source may include one or more MRelements that operate based on a static current (e.g., a low DCcurrent). The static current may also be referred to as sensing currentand may be less than an amount of current typically needed to switch thestate of a MR element. Current pulses are not applied to the one or moreMR elements to induce changes in resistance. Rather, changes inresistance of the MR element(s) due to thermal noise and/or otherphenomenon are detected and used to generate random values. Using staticcurrent for the MR element(s) may provide various advantages such as lowpower consumption, simplified circuit design, etc. The low-energyentropy source uses low-energy phenomena (e.g., thermal noise) togenerate entropy whereas a high-energy entropy source uses higher energystimuli (e.g., current pulses) to generate entropy. The low-energyentropy source may generate entropy of suitable quantity and quality,which may be comparable to the entropy from a high-energy entropysource.

FIG. 2A shows a schematic diagram of a low-energy entropy source 110 x,which is one design of entropy source 110 in FIG. 1. Entropy source 110x includes a resistor 210, a MR element 220, and a sensing circuit 230.Resistor 210 has one end coupled to a first reference voltage (V_(REF1))and a second end coupled to node X. Resistor 210 may also be coupled toa power supply voltage (V_(DD)) instead of the V_(REF1) voltage. MRelement 220 has one end coupled to node X and the other end coupled tocircuit ground. Sensing circuit 230 includes a sense amplifier 240(e.g., a comparator) and a D flip-flop 250. Sense amplifier 240 has itsnon-inverting input coupled to node X, its inverting input receiving asecond reference voltage (V_(REF2)), and its output coupled to the Dinput of flip-flop 250. Flip-flop 250 also receives a clock at its clockinput and provides first random values (e.g., random bits) at its Qoutput. An advantage of using flip-flop 250 is that all transitions ofthe output of the flip-flop are synchronized with the clock.

MR element 220 may comprise a STT-MTJ device or some other type of MRelement. A STT-MTJ device is formed by a sandwich of two layers ofmagnetic material with a magnetic tunneling layer in the middle. Twoelectrical conductors are connected to the two layers of magneticmaterial. The resistance of the STT-MTJ device is variable and dependson the relative magnetization of the two layers. One of the two layersof magnetic material typically has fixed magnetization (spinpolarization) and may be referred to as a fixed layer. The other of thetwo layers of magnetic material may be switched and may be referred toas a free layer. The relative magnetization of the two layers may switchspontaneously (e.g., due to thermal noise/energy) even when no drivingcurrent is applied. The resistance of the STT-MTJ device depends on therelative magnetization of the two layers.

In the design shown in FIG. 2A, a resistive voltage divider is used tosense the resistance of MR element 220. In particular, the voltage atnode X (V_(X)) is dependent on a fixed resistance R₁ of resistor 210, avariable resistance R₂ of MR element 220, and the V_(REF1) voltageapplied to the resistive voltage divider. The V_(X) voltage may beexpressed as:

$\begin{matrix}{V_{X} = {V_{{REF}\; 1} \times {\frac{{R\;}_{2}}{R_{1} + R_{2}}.}}} & {{Eq}\mspace{14mu} (1)}\end{matrix}$

As shown in equation (1), when the R₂ resistance of MR element 220changes due to spontaneous switching of the relative magnetization ofthe two layers of magnetic material, the V_(X) voltage also changescorrespondingly. Sense amplifier 240 compares the V_(X) voltage againstthe V_(REF2) voltage, provides a high output voltage if the V_(X)voltage is higher than the V_(REF2) voltage, and provides a low outputvoltage otherwise. The R₁ resistance of resistor 210, the V_(REF1)voltage, and/or the V_(REF2) voltage may be selected such that the V_(X)voltage is near the V_(REF2) voltage when the resistance of MR element220 is at a target value.

Sense amplifier 240 can sense the resistance of MR element 220 andprovide binary output values based on the sensed resistance. The binaryoutput values from sense amplifier 240 are sampled by flip-flop 250based on the clock to obtain first random values. Sampling the outputvalues from sense amplifier 240 with flip-flop 250 may ensureconformance with setup times and hold times of subsequent digitalcircuits.

The design in FIG. 2A detects changes in the resistance of MR element220 based on low-energy phenomena. In particular, the resistance of MRelement 220 changes due to free oscillation without any driving current.This design may result in a relatively simple circuit for entropy source110 x. This design may also mitigate wear out and improve reliability ofMR element 220. A MR element may also be designed and fabricated suchthat it can more readily undergo spontaneous state switch underagitation from thermal noise and/or other sources of energy. Forexample, a STT-MTJ device may be implemented with weak retention and/orwith no stable axis so that it can undergo spontaneous state switch.

FIG. 2B shows a schematic diagram of a low-energy entropy source 110 y,which is another design of entropy source 110 in FIG. 1. Entropy source110 y includes resistor 210, MR element 220, and sensing circuit 230,which are coupled as described above for FIG. 2A, albeit with resistor210 being coupled to the V_(DD) voltage instead of the V_(REF1) voltage.Entropy source 110 y further includes a voltage divider formed byresistors 212 and 214. Resistor 212 is coupled between the V_(DD)voltage and node Y. Resistor 214 is coupled between node Y and circuitground. Sense amplifier 240 has its non-inverting input coupled to nodeX, its inverting input coupled to node Y, and its output coupled to theD input of flip-flop 250. Flip-flop 250 also receives a clock at itsclock input and provides the first random values (e.g., random bits) atits Q output.

FIG. 2B uses a bridge circuit to measure the resistance of MR element220. The bridge circuit allows sense amplifier 240 to compare thevoltage at node X against the voltage at node Y. Hence, V_(REF1) andV_(REF2) reference voltages are not needed to sense the impedance of MRelement 220, which may simplify circuit design.

FIGS. 2A and 2B show two designs of sensing the variable resistance ofMR element 220 using a resistive voltage divider. The variableresistance of MR element 220 may also be sensed in other manners. Inanother design, a current source may apply a static current to MRelement 220 (e.g., with resistor 210 omitted). The V_(X) voltage at nodeX would then be dependent on the static current (which is known) and theresistance of MR element 220 (which is being measured). In yet anotherdesign, another resistor may be connected in series with MR element 220,and a voltage may be applied to the series combination. The voltageacross one of the elements (the MR element or the resistor) may besensed. In yet another design, MR element 220 may be placed in a“bridge” circuit, which may be any of the bridge circuits known by oneskilled in the art. The bridge circuit may avoid the need for areference voltage (e.g., the V_(REF2) voltage in FIG. 2A).

In yet another design, a second MR element may be coupled to theinverting input of sense amplifier 240 and may be used to generate thereference voltage. A resistor may be coupled between the second MRelement and a supply voltage, or a current source may provide a staticcurrent to the second MR element. MR element 220 coupled to thenon-inverting input and the second MR element coupled to the invertinginput of sense amplifier 240 may have different designs, differentshapes, different sizes, different thickness, and/or othercharacteristics that are different in order to provide good matching andbetter tracking for the reference voltage.

In general, the resistance of MR element 220 may be measured by (i)passing a current through the MR element and sensing the voltage or (ii)applying a voltage to the MR element and sensing the current. For option(i), a small amount of current may be used to sense the impedance (andhence the state) of MR element 220. This small amount of current may bewell below the amount needed to probabilistically flip the magnetizationof MR element 220. The total magnetic moment of MR element 220 may alsobe measured.

FIGS. 2A and 2B show two designs of a low-energy entropy source with asingle MR element 220. In general, a low-energy entropy source mayinclude any number of MR elements, which may be coupled in any manner.In one design, multiple MR elements may be coupled in series. In anotherdesign, multiple MR elements may be coupled in parallel. The series orparallel combination of MR elements may be coupled between node X andcircuit ground. The use of multiple MR elements may (i) improvecollection of entropy from more MR elements, (ii) improve integratedcircuit (IC) yield with redundant MR elements since the yield on anygiven MR element will be less than 100%, and (iii) minimally increasecost and circuit/die area since the MR elements are typically small insize.

An entropy source may include one or more MR elements having resistancethat can be changed by applying write pulses (e.g., current pulses). Inthis case, changes in the resistance of the MR element(s) may bedetected based on high-energy phenomena. Operating the MR element(s)based on high-energy phenomena may result in more robust operation forthe entropy source but may cause faster wear out of the MR element(s).

FIG. 3 shows a schematic diagram of a high-energy entropy source 110 z,which is another design of entropy source 110 in FIG. 1. Within entropysource 110 z, resistors 310, 312 and 314 have one end coupled to node Eand the other end coupled to three ports of a control circuit 340. A MRelement 320 has one end coupled to node E and the other end coupled tocircuit ground. A sense amplifier 330 (e.g., a comparator) has itsnon-inverting input coupled to node E, its inverting input receiving areference voltage (V_(REF)), and its output coupled to an input ofcontrol circuit 340. Control circuit 340 also receives a clock at itsclock input and provides first random values at its output. In anotherdesign, sense amplifier 330 may directly provide the first randomvalues.

Control circuit 340 may generate write pulses to change the state of MRelement 320. MR element 320 may be in either state ‘0’ or ‘1’ at anygiven moment. State ‘0’ may correspond to the resistance of MR element320 being less than a target value, and state ‘1’ may correspond to theresistance of MR element 320 being greater than the target value.

In general, a pulse may be a current pulse or a voltage pulse and may beof either positive or negative polarity. In one design, control circuit340 may include (i) a positive pulse generator coupled to resistor 312via a first switch and (ii) a negative pulse generator coupled toresistor 314 via a second switch. A positive current pulse may beapplied to MR element 320 via resistor 312 to flip the state of MRelement 320 from ‘0’ to ‘1’. A negative current pulse may be applied toMR element 320 via resistor 314 to flip the state of MR element 320 from‘1’ to ‘0’. A positive pulse may be applied to MR element 320 viaresistor 312 by opening the second switch, enabling the positive pulsegenerator, and closing the first switch. A negative pulse may be appliedto MR element 320 via resistor 314 by opening the first switch, enablingthe negative pulse generator, and closing the second switch. Resistors312 and 314 may also be replaced with two current paths. Each pulsegenerator may generate voltage or current pulses of appropriateamplitude, e.g., current pulses of 100 microamperes (μA) or some othervalue. The pulses may cause the relative magnetization of the two layersof magnetic material of MR element 320 to change with some probability.A change in the relative magnetization may cause the resistance of MRelement 320 to change.

In another design, control circuit 340 may include a single pulsegenerator. A first set of switches may connect this pulse generator suchthat it can generate (i) a positive pulse for MR element 320 viaresistor 312 or (ii) a negative pulse for MR element 320 via resistor314. In yet another design, one or more pulse generators may be formedby controlling switches coupled between resistors 312 and 314 and powersupply sources. The width of the pulses may be determined by theduration of the switch closures.

In one design, a write pulse may be applied to MR element 320, and theresistance of MR element 320 may be sensed after applying the writepulse. In another design, the resistance of MR element 320 may besensed, and a write pulse may then be applied to MR element 320 topossibly change its state. In yet another design, the impedance of MRelement 320 may be sensed while a write pulse is applied to MR element320.

FIG. 4 shows a flow diagram of a design of a process 400 performed bycontrol circuit 340 in FIG. 3. Initially, a sensing/read current may beturned on via resistor 310 in FIG. 3, and the state of MR element 320may be sensed by sense amplifier 330 (block 412). A determination may bemade whether the sensed state of MR element 320 is ‘0’ or ‘1’ (block414). If state ‘0’ is sensed in block 414, then a logic ‘0’ may beprovided to an entropy accumulator (block 416). The sensing current viaresistor 310 may be turned off, and a write pulse (e.g., a positivecurrent pulse) that tends to flip the magnetization of MR element 320 tostate ‘1’ may be applied (block 418). Otherwise, if state ‘1’ is sensedin block 414, then a logic ‘1’ may be provided to the entropyaccumulator (block 420). The sensing current via resistor 310 may beturned off, and a write pulse (e.g., a negative current pulse) thattends to flip the magnetization of MR element 320 to state ‘0’ may beapplied (block 422). The process returns to block 412 after block 418 or422.

Control circuit 340 in FIG. 3 may be implemented in various manners. Inone design, control circuit 340 may include a positive pulse generatorcoupled to resistor 312, a negative pulse generator coupled to resistor314, and switches, as described above. The switches may enable andconnect either the positive pulse generator or the negative pulsegenerator to MR element 320 at any given moment. In another design,control circuit 340 may include a single pulse generator whose outputmay be placed across the two terminals of MR element 320 in a positiveor negative manner via switches. In this design, the two terminals of MRelement 320 may be placed across the pulse generator, and resistors 312and 314 may be absorbed into a block containing the pulse generator. Inyet another design, a circuit may connect one terminal of MR element 320to a power supply (e.g., via resistor 310) and may connect the otherterminal of MR element 320 to circuit ground. Switching betweenconnection to the power supply or circuit ground may be selected basedon whether it is desired to flip MR element 320 to ‘0’ or ‘1’ state.

In one design, entropy source 110 z may operate such that each writepulse generated by control circuit 340 for MR element 320 hasapproximately 50% probability of switching the state of MR element 320.Control circuit 340 may include circuitry to control the amplitudeand/or duration of write pulses and/or the amount of time between writepulses to obtain appropriately 50% probability of switching state. Forexample, a feedback circuit (such as a state machine) within controlcircuit 340 may average of the number of ‘0’ and ‘1’ values provided bysense amplifier 330 over a sufficiently long time and may adjust thewrite pulses (e.g., adjust the voltage, current, and/or duration of thewrite pulses) toward the 50% probability switching point of MR element320 to obtain a more unbiased output from sense amplifier 330.

In another design, control circuit 340 may apply a series of writepulses to MR element 320 until it toggles state. The number of writepulses applied to toggle the state of MR element 320 may be provided asthe first random values. MR element 320 may be reset to an initial statebefore the series of write pulses is applied.

A resistive voltage divider is formed by resistor 310 having a fixedresistance and MR element 320 having a variable resistance, in similarmanner as resistor 210 and MR element 220 in FIGS. 2A and 2B. Theresistance of MR element 320 may be sensed by comparing the voltage atnode E (V_(E)) against the V_(REF) voltage by sense amplifier 330. Theresistance of MR element 320 may also be sensed in other manners. In anycase, sense amplifier 330 may provide binary output values based on thesensed resistance of MR element 320. The binary output values from senseamplifier 330 may be sampled by control circuit 340 based on the clockto obtain the first random values.

FIG. 3 shows a design of changing the resistance of MR element 320 withwrite pulses and sensing the resistance of MR element 320 with aresistive voltage divider. The resistance of MR element 320 may also bechanged in other manners. For example, the resistance of MR element 320may be changed by a strong external magnetic field.

FIG. 3 shows a design of an entropy source with a single MR element 320.In general, an entropy source may include any number of MR elements,which may be coupled in series, in parallel, or in some other manner.The use of multiple MR elements may improve entropy collection as wellas IC yield.

FIG. 5 shows a schematic diagram of an entropy source 110 w, which isyet another design of entropy source 110 in FIG. 1. Entropy source 110 wincludes a M×N array 510 with M rows and N columns of MR cells 520,where in general M>1 and/or N>1. Each MR cell 520 may be implementedbased on various designs, as described below. Each column includes M MRcells 520 aj to 520 mj, switches 522 j to 528 j, and programming(“Prog.”) sources 532 j and 534 j, where j is a column index and jε{a, .. . , n}. The M MR cells 520 aj to 520 mj in each column j are connectedto a bit line (BL) 542 j and a select line (SL) 544 j for that column.The M MR cells 520 aj to 520 mj in each column j are further connectedto M word lines (WL) 546 a to 546 m, respectively. For each column j,switch 522 j is coupled between programming source 532 j and a first endof bit line 542 j, and switch 524 j is coupled between programmingsource 534 j and a first end of select line 544 j. For each column j,switch 526 j is coupled between a second end of bit line 542 j andcircuit ground, and switch 528 j is coupled between a second end ofselect line 544 j and circuit ground. For each column j, the second endof bit line 542 j and the second end of select line 544 j are providedto a sensing circuit 550. Sensing circuit 550 can sense the resistanceof each MR cell selected by the associated word line and bit line.Sensing circuit 550 provides first random values based on the sensedresistance of the selected MR cells.

For each column j, programming source 532 j may be used to change thestate of MR cells 520 aj to 520 mj in column j from ‘0’ to ‘1’.Programming source 534 j may be used to change the state of MR cells 520aj to 520 mj from ‘1’ to ‘0’. Programming sources 532 j and 534 j maythus be used to write MR cells 520 aj to 520 mj. In one design, the sameprogramming sources 532 j and 534 j may be used for both (i) writecircuitry used to change the state of MR elements 520 aj to 520 mj and(ii) read circuitry used to sense the state of MR elements 520 aj to 520mj.

In one design, programming sources 532 and 534 may be current sources,e.g., for MR cells 520 comprising MR elements coupled in series, asshown in FIG. 6B. In another design, programming sources 532 and 534 maybe voltage sources, e.g., for MR cells 520 comprising MR elementscoupled in parallel, as shown in FIG. 6C.

In one design, programming sources 532 and 534 may be fixed current orvoltage sources providing current or voltage pulses of fixedamplitude/magnitude and width. In another design, programming sources532 and 534 may be configurable current or voltage sources providingcurrent or voltage pulses of adjustable amplitude and/or width. A MRcell may be in either state P or state AP at any given moment. State Pmay be equivalent of logic “0” of a MR element, and state AP may beequivalent of logic “1” of a MR element. In one design, programmingsources 532 and 534 may be independently configured to provide thedesired programming of MR cells 520 in two directions—a first directionfrom state P to state AP and a second direction from state AP to stateP.

The probability of switching the state of a given MR cell may bedependent on the amplitude of a programming pulse (e.g., a current pulseor a voltage pulse) applied to the MR cell. A desired/target probabilityof switching state in the first direction may be obtained by adjustingthe amplitude of the programming pulses from programming sources 532. Adesired probability of switching state in the second direction may beobtained by adjusting the amplitude of the programming pulses fromprogramming sources 534. For example, a pulse from a programming source532 may be applied to a first MR cell to cause this MR cell to switch tothe AP state with approximately 50% probability. A pulse from aprogramming source 534 may be applied to a second MR cell to cause thisMR cell to switch to the P state with approximately 50% probability. Ingeneral, a desired/target probability of switching state in the first orsecond direction may be obtained by adjusting the amplitude of theprogramming pulses and/or the duration of the programming pulses.

A programming source 532 or 534 may be configured to provide programmingpulses of suitable amplitude that can (i) probabilistically switch thestate of a MR cell (e.g., with a probability between 20 to 80%) or (ii)deterministically switch the state of the MR cell (e.g., with a highprobability of more than 90%). For example, a programming source 532 or534 may provide (i) programming pulses of a first amplitude (e.g., 80μA) for 20% probabilistic switching or (ii) programming pulses of asecond amplitude (e.g., 150 μA) for 99% deterministic switching.Programming sources 532 and 534 may allow for desired/optimalprobabilistic programming of MR cells in both directions, from state Pto state AP and also from state AP to state P.

A MR cell may be probabilistically programmed in either the first orsecond direction in a single operation, e.g., with a single programmingpulse from one programming source 532 or 534. A MR cell may also beprobabilistically programmed in multiple operations in order to improvethe quality and quantity of entropy from the MR cell. For example, a MRcell may be probabilistically programmed with a first switchingprobability in a first operation and then with a second switchingprobability in a second operation. The first and second switchingprobabilities may or may not be close to a preferred 50% switchingprobability.

In one design, a MR cell may be programmed as follows. A programmingcount may be initialized to zero. The MR cell may be read to determineits current state. The MR cell may then be programmed to switch to anopposite state with a particular probability, which may or may not beclose to the preferred 50% switching probability. The programming countmay then be incremented. If the programming count is less than a totalcount (e.g., 16), then the MR cell may be programmed once more byrepeating the steps described above. In general, the quality of entropyfrom the MR cell improves for progressively larger total count andprogressively more programming operations, even when the switchingprobability deviates far from the preferred 50% switching probability.

In one design, the first random values from entropy source 110 w may beused directly as the second random values. In another design, the firstrandom values from entropy source 110 w may be further processed bypost-processing module 120 to generate the second random values havingbetter randomness characteristics. In this design, entropy source 110 wmay be used for entropy generation, and entropy of the desired qualityand quantity may be obtained by adjusting the total count.

Entropy source 110 w can generate entropy of the desired quality andquantity for a wide range of switching probabilities (e.g., from 1% to99%) between states. For example, entropy source 110 w can generate eachrandom bit with approximately 50% probability of being “0” andapproximately 50% probability of being “1” even when the switchingprobabilities are not close to a preferred 50% switching probability andeven when the switching probabilities are unknown as long as they arenot 0 or 100%. The total count may be selected to provide entropy of thedesired quality and quantity. Entropy source 110 w can generate entropyof the desired quality and quantity without having to adjust theamplitude and/or width of the programming pulses from programmingsources 532 and 534 to obtain approximately 50% switching probability.The ability to generate random bits having approximately equalprobability of being “0” or “1” with a wide range of switchingprobabilities may be highly desirable since it may be difficult orimpractical to obtain 50% switching probability over IC process,voltage, and temperature (PVT) variations.

Switches 522 to 528 in FIG. 5 may be implemented with N-channel metaloxide semiconductor (NMOS) transistors, P-channel metal oxidesemiconductor (PMOS) transistors, and/or transistors of other types. Foreach column j, switches 524 j and 526 j are controlled by a firstcontrol signal Uj for column j, and switches 522 j and 528 j arecontrolled by a second control signal Vj for column j.

FIG. 6A shows a design of a MR cell 520 a, which may be used for each ofthe MR cells 520 in FIG. 5. In this design, MR cell 520 a includes asingle MR element 620 (e.g., a STT-MTJ device) and a NMOS transistor622. NMOS transistor 622 has its drain coupled to a select line (SL),its gate coupled to a word line (WL), and its source coupled to oneterminal of MR element 620. The other terminal of MR element 620 iscoupled to a bit line (BL). NMOS transistor 622 may be (i) turned On toconnect MR element 620 between the source line and the bit line or (ii)turned Off to disconnect MR element 620 from the source line and the bitline.

FIG. 6B shows a design of a MR cell 520 b, which may also be used foreach of the MR cells 520 in FIG. 5. In this design, MR cell 520 bincludes multiple (K) MR elements 620 a to 620 k coupled in series andNMOS transistor 622. NMOS transistor 622 has its drain coupled to aselect line (SL), its gate coupled to a word line (WL), and its sourcecoupled to the terminal for the free layer of the topmost MR element 620a. MR elements 620 may be STT-MTJ devices that may be coupled such thatthe fixed layer of one STT-MTJ device (e.g., STT-MTJ device 620 a) iscoupled to the free layer of the next STT-MTJ device (e.g., STT-MTJdevice 620 b). The terminal for the fixed layer of the bottommost MRelement 620 k is coupled to a bit line (BL). NMOS transistor 622 may be(i) turned On to connect MR elements 620 a to 620 k between the sourceline and the bit line or (ii) turned Off to disconnect MR elements 620 ato 620 k from the source line and the bit line.

FIG. 6C shows a design of a MR cell 520 c, which may also be used foreach of the MR cells 520 in FIG. 5. In this design, MR cell 520 cincludes multiple (K) MR elements 620 a to 620 k coupled in parallel andNMOS transistor 622. NMOS transistor 622 has its drain coupled to aselect line (SL), its gate coupled to a word line (WL), and its sourcecoupled to the terminals for the free layer of the K MR elements 620 ato 620 k. MR elements 620 may be STT-MTJ devices that may be coupledsuch that the free layers of all STT-MTJ devices are coupled togetherand the fixed layers of all STT-MTJ devices are also coupled together.The terminals for the fixed layer of the K MR elements 620 a to 620 kare coupled to a bit line (BL). NMOS transistor 622 may be (i) turned Onto connect MR elements 620 a to 620 k between the source line and thebit line or (ii) turned Off to disconnect MR elements 620 a to 620 kfrom the source line and the bit line.

Referring back to FIG. 5, programming sources 532 and 534 may be currentsources if MR cells 520 are implemented with series-coupled MR cell 520b in FIG. 6B. programming sources 532 and 534 may be voltage sources ifMR cells 520 are implemented with parallel-coupled MR cell 520 c in FIG.6C.

Entropy source 110 w in FIG. 5 may operate as follows. The state of agiven MR cell 520 ij in row i and column j may be sensed by (i)activating word line WLi for row i to turn on NMOS transistor 622 for MRcell 520 ij, (ii) opening switches 522 j to 528 j for column j, and(iii) sensing the resistance between the BLj and SLj lines. The state ofMR cell 520 ij may be changed from ‘0’ to ‘1’ by (i) activating wordline WLi for row i, (ii) applying programming source 532 j for column jto MR cell 520 ij, (iii) closing switches 522 i and 528 i for column j,and (iv) opening switches 524 j and 526 j for column j. The state of MRcell 520 ij may be changed from ‘1’ to ‘0’ by (i) activating word lineWLi for row i, (ii) applying programming source 534 j for column j to MRcell 520 ij, (iii) closing switches 524 i and 526 i for column j, and(iv) opening switches 522 j and 528 j for column j. Multiple MR elementsin a given column may be sensed concurrently by activating the wordlines for these MR elements. Different MR cells 520 may be sensed indifferent clock cycles by properly activating the control lines forthese MR cells.

In one design, a reference array may be used to sense the resistance andstate of MR elements 520 in array 510. In one design, the referencearray may be similar (e.g., identical) to MR array 510. In anotherdesign, the reference array may be different from MR array 510. Forexample, the MR elements in array 510 may be different from the MRelements in the reference array, e.g., due to different designs,different shapes, sizes, thickness, etc. The reference array may also beimplemented with poly resistors instead of MR elements.

An entropy source may include multiple MR elements or cells (e.g., e.g.,as shown in FIG. 5) in order to obtain the advantages described above.Such an entropy source may be operated in various manners to improveperformance of entropy generation.

In one design, entropy generation rate may be increased by interleavingor multiplexing the outputs of multiple MR elements (e.g., hundreds orthousands of MR elements). For example, a single MR element may besensed at a rate of 10 MHz and may support an entropy generation rate of10 MHz. A much higher entropy generation rate of 10 GHz may be achievedby sequentially sensing 1000 MR elements and interleaving the outputs ofthese MR elements

In another design, power consumption and switching current may bereduced by multiplexing the outputs of multiple MR elements. Forexample, a single MR element may be sensed at a rate of 10 MHz withswitching pulses of 100 ns or less to obtain an entropy generation rateof 10 MHz. The same 10 MHz entropy generation rate may be achieved bysequentially sensing 10 MR elements with switching pulses of 1 μs orless and interleaving the outputs of these MR elements. The longerswitching pulses may reduce power consumption.

In another aspect, a RN generator may include an entropy source and apost-processing module, e.g., as shown in FIG. 1. The entropy source maygenerate first random values based on one or more MR elements. Thepost-processing module may receive the first random values from theentropy source and may generate the second random values having betterrandomness properties. The post-processing module may be implemented invarious manners, and some exemplary designs of the post-processingmodule are described below.

FIG. 7A shows a block diagram of a RN generator 100 a, which is onedesign of RN generator 100 in FIG. 1. In this design, RN generator 100 aincludes entropy source 110 and a cryptographic hash module 120 a, whichis one design of post-processing module 120 in FIG. 1. Hash module 120 areceives first random values (e.g., random bits) from entropy source 110and generates second random values. In one design, hash module 120 aaggregates each block of L random bits from entropy source 110 to form aL-bit random value, where L may be any suitable integer value. Hashmodule 120 a then hashes a number of L-bit random values based on acryptographic/secure hash algorithm and provides a N-bit hash value,where N may be any suitable integer value. The N-bit hash value is alsocommonly referred to as a hash digest and is provided as a second randomvalue. Hash module 120 a may implement SHA-1 (Secure Hash Algorithm),SHA-2 (which includes SHA-224, SHA-256, SHA-384 and SHA-512), MD-4(Message Digest), MD-5, or some other secure hash algorithm known in theart. A secure hash algorithm has cryptographic properties so that thefunction between an input message and its digest is irreversible and thelikelihood of two input messages mapping to the same digest is verysmall. A secure hash algorithm may receive an input message of anylength and may provide a hash digest of a fixed length.

FIG. 7B shows a block diagram of a RN generator 100 b, which is anotherdesign of RN generator 100 in FIG. 1. In this design, RN generator 100 bincludes K entropy sources 110 a to 110 k and a cryptographic hashmodule 120 b, which is another design of post-processing module 120 inFIG. 1. In general, K may be any integer value greater than one. The useof multiple entropy sources may improve randomness. Each of the Kentropy sources 110 a to 110 k may be implemented with entropy source110 x in FIG. 2A, entropy source 110 y in FIG. 2B, entropy source 110 zin FIG. 3, entropy source 110 w in FIG. 5, or some other entropy source.Each entropy source 110 in FIG. 7B may generate a sequence of firstrandom values (e.g., random bits) based on one or more MR elements.

Within hash module 120 b, K shift registers 720 a to 720 k may receivethe first random values from K entropy sources 110 a to 110 k,respectively. Each shift register 720 may aggregate each block of Qrandom bits from an associated entropy source 110 to form a Q-bit randomvalue, where Q may be any integer value greater than one. Hash module120 b may receive Q-bit random values from shift registers 720 a to 720k and may combine these Q-bit random values to form L-bit random values.In one design, hash module 120 b may aggregate each set of K Q-bitrandom values from shift registers 720 a to 720 k to obtain one L-bitrandom value, where K*Q=L. In another design, hash module 120 b maycombine each set of K Q-bit random values from shift registers 720 a to720 k with an exclusive-OR (XOR) function to obtain one L-bit randomvalue, where Q=L. Hash module 120 b may also combine each set of K Q-bitrandom values from shift registers 720 a to 720 k in other manners. Inany case, a hash function 730 may hash a number of L-bit random valuesbased on a cryptographic/secure hash algorithm and provide a N-bit hashvalue, where N may be any suitable integer value.

In one design, hash function 730 may have a wide input width of L bits,where L may be a block size of the hash function, which may be 256 bitsfor SHA-256. In another design, hash function 730 may have an inputwidth of an integer number of bytes, e.g., 1, 2, 4 or 8 bytes. Shiftregisters 720 may be used to accumulate first random values (e.g.,random bits) from entropy sources 110 a to 110 k, as shown in FIG. 7B.In yet another design, hash function 730 may directly receive the firstrandom values from entropy sources 110 a to 110 k, and shift registers720 may be omitted.

FIG. 8A shows a block diagram of a RN generator 100 c, which is yetanother design of RN generator 100 in FIG. 1. In this design, RNgenerator 100 c includes entropy source 110 and a cyclic redundancycheck (CRC) module 120 c, which is another design of post-processingmodule 120 in FIG. 1. CRC module 120 c receives first random values(e.g., random bits) from entropy source 110 and generates second randomvalues. CRC module 120 c may be implemented with a linear feedback shiftregister (LFSR) composed of R registers, where R may be any integervalue. The R registers may be connected based on a generator polynomialthat can provide an output having good statistical properties. In onedesign, the first random values may be provided to CRC module 120 c in asimilar manner as a data packet provided to a CRC module. CRC module 120c may provide a N-bit second random value after a particular number offirst random values have been provided to the CRC module, e.g., in asimilar manner as a CRC being generated after an entire data packet hasbeen provided to the CRC module, where N≦R. The random bits from entropysource 110 may also be used to seed a deterministic pseudo-random bitgenerator, or a module that generates bits based on an error detectioncode, or some other bit generator.

FIG. 8B shows a block diagram of a RN generator 100 d, which is yetanother design of RN generator 100 in FIG. 1. In this design, RNgenerator 100 d includes multiple (K) entropy sources 110 a to 110 k anda CRC module 120 d, which is yet another design of post-processingmodule 120 in FIG. 1. Each entropy source 110 may generate a sequence offirst random values (e.g., random bits) based on one or more MRelements.

In the design shown in FIG. 8B, CRC module 120 d includes K XOR gates820 a to 820 k and a LFSR 830. LFSR 830 may include R registers coupledin series. The outputs of the R registers may be shifted to the left byK bits in each clock cycle. XOR gates 820 a to 820 k may receive thefirst random values from K entropy sources 110 a to 110 k, respectively.Each XOR gate 820 may also receive one or more bits in LFSR 830, withthe one or more bits being determined based on a generator polynomialbeing implemented by CRC module 120 d. Each XOR gate 820 may performmodulo-2 addition of all the input bits and provide a 1-bit output ineach clock cycle. K XOR gates 820 a to 820 k may provide their outputsto the first K registers of LFSR 830. In one design, CRC module 120 dmay receive the first random values from entropy sources 110 a to 110 kand may provide a N-bit second random value after a particular number offirst random values have been provided to the CRC module, where N≦R.

In one exemplary design, K may be equal to 4, R may be equal to 34, andN may be equal to 32. Four entropy sources 110 may provide their randombits to four XOR gates 820 within CRC module 120 d. CRC module 120 d mayalso include a 34-bit LFSR 830 and may implement the following generatorpolynomial:

x ³³ +x ¹¹+1=0.  Eq (2)

In the exemplary design, the first XOR gate 820 a may receive the randombits from the first entropy source 110 a and also bits 10 and 33 of LFSR830. The second XOR gate 820 b may receive the random bits from thesecond entropy source 110 b and also bits 9 and 32 of LFSR 830. Thethird XOR gate may receive the random bits from the third entropy sourceand also bits 8 and 31 of LFSR 830. The fourth XOR gate may receive therandom bits from the fourth entropy source and also bits 7 and 30 ofLFSR 830. The first to fourth XOR gates may provide their outputs toregisters 3, 2, 1 and 0, respectively, of LFSR 830. LFSR 830 may beshifted to the left by 4 bits in each clock cycle. A 32-bit secondrandom value may be provided by 32 registers of LFSR 830 (e.g.,registers 2 to 33) in every 16 or more clock cycles (e.g., after 64 ormore random bits from the four entropy sources have been provided toLFSR 830).

FIG. 9 shows a block diagram of a RN generator 100 e, which is yetanother design of RN generator 100 in FIG. 1. In this design, RNgenerator 100 e includes entropy source 110 and a post-processing module120 e. Post-processing module 120 e includes an entropy accumulator 122and a cryptographic module 124. Entropy accumulator 122 may receive andaccumulate the first random values from entropy source 110 and provideintermediate random values. Entropy accumulator 122 may perform entropyaccumulation based on a polynomial generator, a code, etc. Cryptographicmodule 124 may receive the intermediate random values and provide secondrandom values. Cryptographic module 124 may implement any cryptographicalgorithm, such as an algorithm listed in Federal Information ProcessingStandards (FIPS) Special Publication 800-90 or others allowed by FIPS140 and its annexes, which are publicly available. Cryptographic module124 may also implement some other cryptographic algorithm known by oneskilled in the art.

FIG. 10 shows a block diagram of a RN generator 100 f, which is yetanother design of RN generator 100 in FIG. 1. In this design, RNgenerator 100 f includes K entropy sources 110 a to 110 k and a combiner120 f, which is yet another design of post-processing module 120 inFIG. 1. The K entropy sources 110 a to 110 k may generate K sequences offirst random values (e.g., random bits). Combiner 120 f may receive theK sequences of first random values from the K entropy sources 110 a to110 k and may generate second random values. In one design that is shownin FIG. 10, combiner 120 f may be implemented with an XOR gate 126having K inputs that receive the K sequences of first random values. Inanother design that is not shown in FIG. 10, combiner module 120 f mayimplement a modulo-M summer, where M may be any suitable value.

RN generator 100 f may generate N-bit second random values in variousmanners. In one design, in each clock cycle, K first random values inthe K sequences may be summed modulo-2^(N) to obtain a N-bit secondrandom value for that clock cycle. For example, if N=2 and K≧4, then ineach clock cycle K first random bits from the K entropy sources 110 a to110 k may be summed modulo-4 to obtain a 2-bit second random value forthat clock cycle. In another design, in each clock cycle, K first randomvalues in the K sequences may be summed modulo-2 to obtain a 1-bitcombined value for that clock cycle. A N-bit second random value may beformed with N combined values provided by combiner 120 f in N clockcycles. Combiner 120 f may also be implemented with other circuits.

FIG. 11 shows a block diagram of a RN generator 100 g, which is yetanother design of RN generator 100 in FIG. 1. In this design, RNgenerator 100 g includes two entropy sources 110 a and 110 b and astream cipher module 120 g, which is another design of post-processingmodule 120 in FIG. 1. Each entropy source 110 generates a sequence ofrandom bits based on one or more MR elements.

Stream cipher module 120 g includes two LFSRs 1120 and 1130 and anon-linear function 1140, which collectively implement a modified K2stream cipher algorithm. LFSR 1120 implements a first generatorpolynomial and includes five Q-bit registers 1122 a to 1122 e that arecoupled in series, where Q may be any integer value greater than one,e.g., Q=8, 16, 32, etc. A multiplier 1124 receives a Q-bit value fromthe last register 1122 e and multiplies this Q-bit value with acoefficient α₀. A summer 1126 receives Q-bit values from multiplier 1124and register 1122 b, sums the two Q-bit values based on finite fieldaddition, and provides a Q-bit result to register 1122 a. Finite fieldaddition of two Q-bit values may be achieved by performing bit-wise XORof the two Q-bit values. LFSR 1130 implements a second generatorpolynomial and includes eleven Q-bit registers 1132 a to 1122 k that arecoupled in series. A multiplier 1134 a receives a Q-bit value fromregister 1132 c and multiplies this Q-bit value with either coefficient1 or α₃, which is selected based on a random bit from entropy source 110a. A multiplier 1134 b receives a Q-bit value from register 1132 k andmultiplies this Q-bit value with coefficient α₁ or α₂, which is selectedbased on a random bit from entropy source 110 b. A summer 1136 areceives and sums the Q-bit values from multiplier 1134 b and register1122 j. A summer 1136 b receives and sums the Q-bit values from summer1136 a and register 1132 e. A summer 1136 c receives and sums the Q-bitvalues from multiplier 1134 a and summer 1136 b. Each summer 1136 sumsits two Q-bit values based on finite field addition and provides a Q-bitresult.

Non-linear function 1140 receives Q-bit values from registers 1122 a and1122 e of LFSR 1120 as well as Q-bit values from registers 1132 a, 1132b, 1132 g and 1132 k of LFSR 1130. Non-linear function 1140 processesthe received Q-bit values based on a non-linear function and providesN-bit second random values. The second random values may be used as acryptographic key for encryption, decryption, and/or other cryptographicand non-cryptographic functions. The non-linear function and the K2stream cipher algorithm are described in detailed by Kiyomoto et al in apaper entitled “A Word-Oriented Stream Cipher Using Clock Control,”which is publicly available.

In the design shown in FIG. 11, one entropy source 110 a is used todynamically select the coefficient for multiplier 1134 a, and anotherentropy source 110 b is used to dynamically select the coefficient formultiplier 1134 b. In this design, the feedback polynomial for LFSR 1130has four possible values depending on the random values from entropysources 110 a and 110 b. In another design, a single entropy source maybe used to select the coefficient for only multiplier 1134 a, or thecoefficient for only multiplier 1134 b, or the coefficients for bothmultipliers 1134 a and 1134 b. For example, random bits of even indicesfrom the entropy source may select the coefficient for multiplier 1134a, and random bits of odd indices from the entropy source may select thecoefficient for multiplier 1134 b. In yet another design, multipleentropy sources may be combined (e.g., XORed) and used to select thecoefficient for multiplier 1134 a. Alternatively or additionally,multiple entropy sources may be combined and used to select thecoefficient for multiplier 1134 b. The use of multiple entropy sourcesto select the coefficient for multiplier 1134 a and/or 1134 b mayimprove resistance to individual MR element failures and may also bringthe percentage of each state ‘0’ or ‘1’ closer to 50%. One or moreentropy sources may also be used to dynamically select the coefficientsfor one or more multipliers of LFSR 1130 in other manners.

Random values from one or more entropy sources may also alter theoperation and/or state of LFSR 1130 in other manners. In one design, therandom values may be combined (e.g., XORed) with selected bits in theLFSR. In another design, the random values may select different taps inthe LFSR. In yet another design, a register (e.g., a shift register) mayaccept many bits from the Q entropy sources. When the register is full,each bit in a set of bits from the LFSR may be replaced with itsprevious value XORed with a selected bit of the register.

FIG. 12 shows a block diagram of a RN generator 100 h, which is yetanother design of RN generator 100 in FIG. 1. In this design, RNgenerator 100 h includes Q entropy sources 110 a to 110 q and a streamcipher module 120 h, which is another design of post-processing module120 in FIG. 1, where Q may be any integer value greater than one.Entropy sources 110 a to 110 q generate Q sequences of random bits. Inthe design shown in FIG. 12, a serial-to-parallel (S/P) converter 1210receives the Q sequences of random bits and provides a sequence of Q-bitrandom values. Each Q-bit random value may include one bit from each ofthe Q sequences of random bits. S/P converter 1210 may be implementedwith straight through wires. In another design that is not shown in FIG.12, S/P converter 1210 receives a single sequence of random bits from asingle entropy source 110 and provides a sequence of Q-bit randomvalues. Each Q-bit random value may be formed based on Q bits in thesingle sequence of random bits. In general, S/P converter 1210 mayreceive one or more sequence of random bits from one or more entropysources and may provide a sequence of Q-bit random values.

Stream cipher module 120 h implements a modified SNOW 3G stream cipheralgorithm and includes a LFSR 1220, a finite state machine (FSM) 1230,and summers 1240 and 1242. LFSR 1220 includes 16 Q-bit registers 1222 ato 1222 p coupled in series and implements a generator polynomialα·x¹⁵+x¹³+α⁻¹·x⁴+1=0. A finite-field multiplier 1224 a receives a Q-bitvalue from the last register 1222 p and multiplies this Q-bit value witha coefficient α₀. A finite-field multiplier 1224 b receives a Q-bitvalue from register 1222 e and multiplies this Q-bit value with acoefficient α⁻¹. A summer 1226 a receives and sums Q-bit values frommultiplier 1224 a and FSM 1230. A summer 1226 b receives and sums Q-bitvalues from summer 1226 a and register 1222 n. A summer 1226 c receivesand sums Q-bit values from summer 1226 b and multiplier 1224 b. Eachsummer 1226 sums its two Q-bit values based on finite field addition andprovides a Q-bit result.

FSM 1230 includes three Q-bit registers 1232 a to 1232 c and twosubstitution boxes (S-boxes) 1234 a and 1234 b. An integer summer 1236 areceives and sums Q-bit values from registers 1222 a and 1232 a based onaddition modulo 2^(Q). A summer 1238 a receives and sums Q-bit valuesfrom summer 1236 a and register 1232 b and provides its Q-bit output asthe output of FSM 1230. Summer 1242 receives and sums Q-bit values fromregister 1222 k and S/P converter 1210. A summer 1238 b receives andsums Q-bit values from summer 1242 and register 1232 c. Each of summers1238 and 1242 sums its two Q-bit values based on finite field additionand provides a Q-bit result. An integer summer 1236 b receives and sumsQ-bit values from summer 1238 b and register 1232 b based on additionmodulo 2^(Q) and provides its Q-bit output to register 1232 a. Summer1240 sums the Q-bit values from register 1222 p and FSM 1230 andprovides N-bit second random values, where N≦Q. S-box 1234 a receivesthe output of register 1232 a and provides an input to register 1232 b.S-box 1234 b receives the output of register 1232 b and provides aninput to register 1232 c. Each S-box 1234 maps a Q-bit input to a Q-bitoutput based on a predefined function.

In one design, FSM 1230 and summer 1242 may be operated for a number ofclock cycles to initialize LFSR 1220. LFSR, FSM 1230, and summer 1240may then be operated to generate the second random values. RN generator100 h may also be operated in other manners.

In one design, entropy sources 110 and S/P converter 1210 may operatebased on the same clock used for LFSR 1220 and FSM 1230. In anotherdesign, LFSR 1220 and FSM 1230 may operate based on a first clock, andentropy sources 110 and S/P converter 1210 may operate based on a secondclock that is faster than the first clock. This design may be especiallyapplicable if each clock cycle steps LFSR 1220 and FSM 1230 one time.

FIGS. 11 and 12 show two examples of continually injecting entropy intoa RN generator. In FIG. 11, RN generator 100 g accepts two random bitsand provides 32 random bits. Hence, RN generator 100 g does not qualifyas a non-deterministic random bit generator (NRBG) according to NISTdefinition. In FIG. 12, RN generator 100 h accepts entropy from MRdevices that is approximately equal to the rate of the output. Hence, RNgenerator 100 h may qualify as a NRBG according to NIST definition.

FIGS. 11 and 12 show two designs of modifying an internal state of twoexemplary cryptographic functions (e.g., stream cipher algorithms) basedon one or more entropy sources, where each entropy source may includeone or more MR elements. The operation of cryptographic functions mayalso be modified based on one or more entropy sources in other mannersbesides the specific examples given in FIGS. 11 and 12. Entropy sourcesmay also be used to modify the internal state and/or the operation ofother cryptographic functions.

Various exemplary designs of post-processing module 120 have beendescribed above. In general, post-processing circuit 120 may receivefirst random values serially from a single entropy source (e.g., asshown in FIG. 7A, 8A, or 9) or in parallel from multiple entropy sources(e.g., as shown in FIG. 7B, 8B, 10, 11 or 12). Post-processing module120 may be an entropy extractor that can combine the first random valuesstatistically or computationally. A statistical entropy extractor mayoperate based on assumptions of a model (e.g., assumptions thatinstances of certain events are independent and identically distributed)and may produce random values that are unbiased and uncorrelated andstatistically indistinguishable from a true random source. Acomputational entropy extractor may feed the first random values into afunction, such as a hash function, and may present the output as a blockof random bits. If the selected hash function closely approximates anideal hash function, then the computational entropy extractor should beable to generate second random values that are indistinguishable from atrue random source based on the first random values derived from one ormore MR elements.

In another aspect, a detection circuit may be used to detect tamperingwith an entropy source comprising one or more MR elements. A MR elementhas a variable resistance that changes based on magnetic field. Forexample, the resistance of a STT-MTJ device can change based on therelative magnetization of the two layers of magnetic material, asdescribed above. A MR element may be subject to tampering, e.g., with amagnet placed in close proximity to the MR element. Tampering with theMR element may be detected as described below.

FIG. 13 shows a schematic diagram of an analog tamper detection circuit1300 that may be used to detect tampering with a MR element 1320. Tamperdetection circuit 1300 includes an entropy source 1310 and a detectionmodule 1330. Within entropy source 1310, a resistor 1312 has one endcoupled to a first reference voltage (V_(REF1)) and the other endcoupled to node A. MR element 1320 has one end coupled to node A and theother end coupled to circuit ground.

Within detection module 1330, a sense amplifier 1332 has its inputcoupled to node A and its output coupled to one end of a resistor 1334.Sense amplifier 1332 may also receive a reference voltage, as shown inFIG. 2A or 2B but not shown in FIG. 13 for simplicity. The other end ofresistor 1334 is coupled to node B. A capacitor 1336 is coupled betweennode B and circuit ground. A first comparator 1340 a has itsnon-inverting input coupled to node B, its inverting input receiving asecond reference voltage (V_(REF2)), and its output coupled to a firstinput of an OR gate 1350. A second comparator 1340 b has its invertinginput coupled to node B, its non-inverting input receiving a thirdreference voltage (V_(REF3)), and its output coupled to a second inputof OR gate 1350. OR gate 1350 provides an error signal. The V_(REF2)voltage is higher than the V_(REF3) voltage. The V_(REF2) and V_(REF3)voltages define a target range of resistance values for MR element 1320under normal operation. A tamper detector 1360 receives the error signalfrom OR gate 1350, determines whether MR element 1320 has been tamperedas described below, and provides a tamper indication.

Sense amplifier 1332 senses the voltage at node A (V_(A)), which isdependent on the resistance of MR element 1320. The sensed voltage isfiltered by a lowpass filter composed of resistor 1334 and capacitor1336. The filtered voltage at node B (V_(B)) is compared against theV_(REF2) voltage by comparator 1340 a and is also compared against theV_(REF3) voltage by comparator 1340 b. The error signal is at logic highwhen the output of either comparator 1340 a or 1340 b is high.

MR element 1320 is used as a sensor to detect external attempts tomanipulate the operation of the MR element, e.g., with a strong magneticfield or temperature. In one design, MR element 1320 may be differentfrom a MR element used in an entropy source. In another design, a MRelement used in an entropy source may also be used as MR element 1320 intamper detection circuit 1300. In any case, the V_(B) voltage islinearly related to the duty cycle of the output of sense amplifier1332, with the duty cycle being dependent on the fraction of output bitsthat are “1”. Comparator 1340 a detects whether the duty cycle exceeds ahigh threshold determined by the V_(REF2) voltage. Comparator 1340 bdetects whether the duty cycle is below a low threshold determined bythe V_(REF3) voltage. The error signal is at logic high when the dutycycle is not within the high and low thresholds. Although not shown inFIG. 13, the output of OR gate 1350 may be provided to a flip-flop,which may provide the error signal. In any case, the error signal mayinclude a sequence of ones and zeros determined based on the detectedduty cycle, which is dependent on the sensed resistance of MR element1320.

Module 1360 may detect tampering with MR element 1320 based on the errorsignal in various manners. In one design, module 1360 may count runs ofones and runs of zeros in the error signal over a predetermined timeinterval. Module 1360 may declare tampering if the count of runs of onesor the count of runs of zeros is either too small or too large. Inanother design, module 1360 may count the number of occurrences ofpredetermined patterns (e.g., patterns of ‘11’, ‘10’, ‘01’, and ‘11’)over a predetermined time interval. Module 1360 may declare tampering ifthe count of any pattern is too small or too large. In yet anotherdesign, module 1360 may provide the sequence of ones and zeros in theerror signal to a compression algorithm. Module 1360 may declaretampering if the output rate of the compression algorithm is too small.Module 1360 may also detect tampering with MR element 1320 based on theerror signal in other manners.

In another design, the output of sense amplifier 1332 may be digitized,e.g., with a flip-flop connected to the output of sense amplifier 1332.The digitized output of sense amplifier 1332 may be filtered with ananalog lowpass filter, which may be formed with resistor 1334 andcapacitor 1336. The lowpass filter may perform averaging of thedigitized output. Comparators 1340 a and 1340 b may compare the filteredsignal against high and low thresholds. The error signal from OR gate1350 may be set to logic high, which indicated tampering, if thefiltered signal is above the high threshold or below the low threshold.

Entropy source 110 c in FIG. 3 (with or without a feedback circuit) mayalso be used to detect tampering. For example, the ratio of ‘1’ to ‘0’values provided by sense amplifier 330 may be determined and comparedagainst a low threshold and a high threshold. The high and lowthresholds may be defined based on a window of allowed values for theratio, which should be centered around 50%. Tampering may be detectedwhen the ratio exceeds the high threshold or falls below the lowthreshold.

In one design, an apparatus (e.g., an IC, a wireless device, anelectronics module, etc.) may include a MR element and a sensingcircuit, e.g., as shown in FIG. 2A or 2B. The MR element (e.g., MRelement 210) may be applied with a static current and may have avariable resistance determined based on magnetization of the MR element.The MR element may comprise a STT-MTJ device or some other type ofdevice having a variable resistance versus magnetization. The sensingcircuit may sense the resistance of the MR element and provide randomvalues based on the sensed resistance of the MR element.

In one design, the sensing circuit may comprise a sense amplifier (e.g.,sense amplifier 240 in FIG. 2A) having a first input coupled to the MRelement, a second input receiving a reference voltage, and an outputproviding sensed values used to generate the first random values. Thesensing circuit may further comprise a resistor (e.g., resistor 210)coupled in series with the MR element, with the combination of theresistor and the MR element forming a resistive voltage divider. In onedesign, the reference voltage (e.g., the V_(REF2) voltage in FIG. 2A)may be generated by a reference voltage generator. In another design,the reference voltage (e.g., the V_(Y) voltage in FIG. 2B) may begenerated based on a resistive voltage divider, which may form a bridgecircuit with the MR element and may be used to measure the resistance ofthe MR element (e.g., as shown in FIG. 2B). In yet another design, asecond MR element may be coupled to the second input of the senseamplifier and may be used to generate the reference voltage.

In one design, a resistor (e.g., resistor 210) may be coupled betweenthe MR element and a voltage and may provide the static current for theMR element (e.g., as shown in FIGS. 2A and 2B). In another design, acurrent source may be coupled to the MR element and may provide thestatic current for the MR element.

In one design, the sensing circuit may further comprise a flip-flop(e.g., flip-flop 250) coupled to the sense amplifier. The flip-flop mayreceive the sensed values from the sense amplifier and provide therandom values. Latching the sensed values with the flip-flop may ensurethat the random values can meet setup times and hold times of digitalcircuits receiving the random values.

In one design, at least one additional MR element may be coupled inseries (e.g., as shown in FIG. 6B) or in parallel (e.g., as shown inFIG. 6C) with the MR element. The use of multiple MR elements mayimprove entropy generation as well as reliability.

In another design, an apparatus (e.g., an IC, a wireless device, anelectronics module, etc.) may include an entropy source and apost-processing module, e.g., as shown in FIG. 1. The entropy source maycomprise at least one MR element and may provide first random valuesbased on the at least one MR element. The post-processing module mayreceive and process the first random values and provide second randomvalues.

In one design, the post-processing module may receive a single sequenceof first random values from a single entropy source and may generate thesecond random values based on this single sequence of first randomvalues. In another design, the post-processing module may receive aplurality of sequences of first random values from a plurality ofentropy sources and may generate the second random values based on theplurality of sequences of first random values.

In one design, the post-processing module may hash the first randomvalues (e.g., based on a cryptographic hash function as shown in FIG.7A) and provide the second random values. In another design, thepost-processing module may include a plurality of shift registers and ahash module, e.g., as shown in FIG. 7B. The plurality of shift registersmay receive a plurality of sequences of first random values from aplurality of entropy sources including the entropy source. The hashmodule may receive a plurality of sequences of intermediate values fromthe plurality of shift registers, hash the intermediate values, andprovide the second random values. Each first random value may comprise a1-bit value, each intermediate value may comprise a Q-bit value, andeach second random value may comprise a N-bit value, where Q and N maybe greater than one. In one design, the total number of bits of eachsecond random value may be less than the total number of bits of allfirst random values used to generate the second random value, so thatthe total number of input bits is greater than the total number ofoutput bits.

In yet another design, the post-processing module may generate thesecond random values based on the first random values and an errordetection code, e.g., a CRC as shown in FIG. 8A. The post-processingmodule may include a LFSR implementing a generator polynomial. The LFSRmay receive the first random values and provide the second randomvalues.

In yet another design, the post-processing module may include aplurality of registers (e.g., registers 830 in FIG. 8B) coupled inseries and at least two combiners. Each combiner may be an XOR gate(e.g., as shown in FIG. 8B), a modulo-2 adder, etc. The at least twocombiners may be coupled to at least two registers in the plurality ofregisters and may receive at least two sequences of first random valuesfrom at least two entropy sources. The plurality of registers and the atleast two combiners may implement a generator polynomial with at leasttwo feedback bits.

In yet another design, the post-processing module may include an entropyaccumulator and a cryptographic module, e.g., as shown in FIG. 9. Theentropy accumulator may receive the first random values and provideintermediate random values. The cryptographic module may receive theintermediate random values and provide second random values. Thecryptographic module may generate the second random values based on acryptographic hash function, a stream cipher algorithm, etc.

In yet another design, the post-processing module may include acombiner. The combiner may comprise an XOR gate as shown in FIG. 10, ora modulo-M summer, where M is an integer greater than one, or some othercircuit. The combiner may receive and process a plurality of sequencesof first random values from a plurality of entropy sources and providethe second random values. The combiner may perform modulo-M summation ofa plurality of first random values in the plurality of sequences offirst random values to obtain a corresponding second random value.

In yet another design, the post-processing module may include a streamcipher generator, e.g., as shown in FIG. 11 or 12. The stream ciphergenerator may generate the second random values. The first random valuesmay alter the operation and/or the internal state of the stream ciphergenerator. In one design, the stream cipher generator may generate thesecond random values based on a K2 stream cipher algorithm, e.g., asshown in FIG. 11. The first random values may select coefficients of theK2 stream cipher algorithm. In another design, the stream ciphergenerator may generate the second random values based on a SNOW 3Gstream cipher algorithm, e.g., as shown in FIG. 12. The first randomvalues may change the internal state of the SNOW 3G stream cipheralgorithm.

In one design, the entropy source may be a low-energy entropy source andmay comprise a biasing circuit and a sensing circuit, e.g., as shown inFIG. 2A or 2B. The biasing circuit (e.g., resistor 210) may provide astatic current for the at least one MR element. The sensing circuit(e.g., sensing circuit 230) may sense the resistance of the at least oneMR element and provide the first random values based on the sensedresistance. In another design, the entropy source may be a high-energyentropy source and may comprise a control circuit and a sensing circuit,e.g., as shown in FIG. 3. The control circuit may generate current orvoltage pulses to change the state of the at least one MR element. Thesensing circuit may sense the resistance of the at least one MR elementand provide random values based on the sensed resistance.

In one design, the first random values may comprise 1-bit values, andthe second random values may comprise multi-bit values. In general, thefirst and second random values may each comprise a value of any numberof bits.

The entropy source may be implemented in hardware, e.g., on an IC, anelectronics module, etc. The post-processing module may be implementedin hardware, software, and/or firmware in various manners, as describedbelow.

In yet another design, an apparatus (e.g., an IC, a wireless device, anelectronics module, etc.) may include an array of MR cells, a sensingcircuit, and a plurality of programming sources, e.g., as shown in FIG.5. The array of MR cells (e.g., MR array 510) may be arranged in aplurality of rows and a plurality of columns A plurality of word linesmay be coupled to the plurality of rows of MR cells. A plurality ofselect lines may be coupled to the plurality of columns of MR cells. Aplurality of bit lines may also be coupled to the plurality of columnsof MR cells. The sensing circuit (e.g., sensing circuit 550) may becoupled to the plurality of select lines and may sense the resistance ofa selected MR cell in the array and provide random values. The pluralityof programming sources (e.g., programming sources 532 and 534) may becoupled to the plurality of select lines and may provide pulses tochange the state of the MR cells in the array. The plurality ofprogramming sources may include (i) a first programming source (e.g.,programming source 532 a) coupled to the selected MR cell when theselected MR cell is to be switched in a first direction and (ii) asecond programming source (e.g., programming source 534 a) coupled tothe selected MR cell when the selected MR cell is to be switched in asecond direction.

Each MR cell may include at least one MR element. In one design, each MRcell may include a single MR element, e.g., as shown in FIG. 6A. Inanother design, each MR cell may include a plurality of MR elementscoupled in series (e.g., as shown in FIG. 6B) or in parallel (e.g., asshown in FIG. 6C). In one design, the MR cells in the array may compriseidentical MR elements. In another design, the MR cells in the array maycomprise MR elements of different designs, shapes, sizes, thickness,etc. in order to improve IC yield.

In one design, the selected MR cell may be programmed in a singleoperation and may be applied with a current pulse or a voltage pulsefrom the first or second programming source in the single operation. Inanother design, the selected MR cell may be programmed in a plurality ofoperations and may be applied with a current pulse or a voltage pulsefrom the first or second programming source in each operation. In onedesign, at least one MR cell may be used to provide a reference voltagefor the sensing circuit.

The plurality of programming sources may provide current pulses orvoltage sources to change the state of the MR cells in the array. In onedesign, at least one of the first and second programming sources mayprovide pulses of a variable amplitude determined based on a targetswitching probability of the selected MR cell. In another design, atleast one of the first and second programming sources may provide pulsesof a variable duration determined based on the target switchingprobability. In yet another design, at least one of the first and secondprogramming sources may provide pulses of a variable amplitude and avariable duration determined based on the target switching probability.In one design, the plurality of programming sources may haveindividually configured pulse amplitude and/or pulse duration.

In one design, the MR cells in the array may be selected and sensed at afirst rate to generate random values at a second rate, which may behigher than the first rate. The MR cells may be interlaced to obtainrandom values at a higher rate.

In yet another design, an apparatus (e.g., an IC, a wireless device, anelectronics module, etc.) may include an entropy source and a detectionmodule, e.g., as shown in FIG. 13. The entropy source may include atleast one MR element (e.g., at least one STT-MTJ device) and may providefirst values based on the at least one MR element. The detection modulemay receive and process the first values and may provide an indicationof tampering with the entropy source.

The detection module may detect tampering in various manners. In onedesign, the detection module may detect tampering with the entropysource based on the percentage of zeros and ones in the first values. Inanother design, the detection module may detect tampering with theentropy source based on runs of zeros and runs of ones in the firstvalues. In yet another design, the detection module may detect tamperingwith the entropy source based on the number of occurrences ofpredetermined patterns of zeros and ones. In yet another design, thedetection module may perform compression of the first values and maydetect tampering with the entropy source based on an output rate of thecompression. The detection module may also detect tampering in othermanners.

FIG. 14 shows a design of a process 1400 for generating random values. Astatic current may be applied to a MR element having a variableresistance determined based on magnetization of the MR element (block1412). The resistance of the MR element may be sensed with the staticcurrent applied to the MR element (block 1414). First random values maybe generated based on the sensed resistance of the MR element (block1416). In one design of blocks 1414 and 1416, the resistance of the MRelement may be compared against a reference value to obtain sensedvalues. The sensed values may then be latched to obtain the first randomvalues.

The first random values may be used directly by an application requiringrandom values. Alternatively, the first random values may be processedto obtain second random values (block 1418). For example, the firstrandom values may be processed based on a cryptographic hash function,an error detection code, a stream cipher algorithm, etc.

In one design, a plurality of sequences of first random values may begenerated by sensing the resistance of a plurality of MR elementsincluding the MR element. The plurality of sequences of first randomvalues may be processed (e.g., with a hash function as shown in FIG. 7B,an error detection code as shown in FIG. 8B, or a combiner as shown inFIG. 10) to obtain second random values.

The first random values from an entropy source comprising at least oneMR element may have one or more of the following characteristics:

-   -   Some unpredictability, even with unlimited computational power,    -   Unknown to adversary,    -   Not influenced by adversary,    -   Not necessarily unbiased or uncorrelated, and    -   Entropy may be less than output bit rate.

The second random values from a RN generator comprising an entropysource and a post-processing module may have one or more of thefollowing characteristics:

-   -   Unpredictable, even with unlimited computational power,    -   Unknown to adversary,    -   Not influenced by adversary,    -   Negligible bias and correlation, and    -   Entropy equal to or very close to output bit rate.

The use of at least one MR element to generate first random values for aRN generator may provide various advantages. First, a MR element mayhave better characteristics than other sources of entropy and may beused to build a good entropy source. Changes in the resistance of the MRelement form a stochastic process. The MR element may be characterizedby a simple verifiable model based on physics of the MR element.Parameters of the model may be estimated based on measurements of the MRelement. The MR element may be verified to obey the model based onmeasurements, computer simulation, etc. An entropy source may be builtwith the MR element without the use of high-gain devices (except for asense amplifier to sense resistance). The entropy source may be low costand low power, may occupy a small circuit area, and may be easilyfabricated on semiconductor devices. The entropy source may have a fastgeneration rate and may be able to provide first random values at a highrate, possibly in the GHz range. The first random values from theentropy source may be conditioned or post-processed to improverandomness.

An entropy source and a RN generator comprising at least one MR elementmay be used in various electronics devices, as described above. The useof the entropy source and the RN generator in a wireless device isdescribed below.

FIG. 15 shows a block diagram of a wireless device 1500, which mayinclude one or more entropy sources and/or one or more RN generators.Wireless device 1500 may be a cellular phone, a smart phone, a tablet, aPDA, a laptop computer, a netbook, a smartbook, a terminal, a handset,etc. Wireless device 1500 may support communication via one or morewireless communication networks, which may include a Code DivisionMultiple Access (CDMA) network, a Global System for MobileCommunications (GSM) network, a Long Term Evolution (LTE) network, awireless local area network (WLAN), etc.

Wireless device 1500 can support bi-directional communication via areceive path and a transmit path. In the receive path, signalstransmitted by base stations and/or other devices may be received by anantenna 1512 and provided to a receiver (RCVR) 1514. Receiver 1514 maycondition and digitize a received signal and provide input samples to adigital section 1520 for further processing. In the transmit path, atransmitter (TMTR) 1516 may receive data to be transmitted from digitalsection 1520. Transmitter 1516 may process and condition the data andmay generate a modulated signal, which may be transmitted via antenna1512 to base stations and/or other devices.

Digital section 1520 may include various processing, interface, andmemory modules such as, for example, a modem processor 1522, a centralprocessing unit (CPU)/reduced instruction set computer (RISC) 1524, amain controller 1526, a static random access memory (SRAM) 1528, asecure module 1530, a read-only memory (ROM) 1532, a NAND Flashcontroller 1534, and a synchronous dynamic RAM (SDRAM) controller 1536,all of which may communicate with one another via one or more buses1560. Modem processor 1522 may perform processing for data transmissionand reception, e.g., encoding, modulation, demodulation, decoding, etc.CPU/RISC 1524 may perform general-purpose processing for variousapplications such as, e.g., voice call, web browsing, multi-media,games, user interface, positioning, etc. Main controller 1526 may directthe operation of various units within digital section 1520. SRAM 1528may store program codes and data used by the controllers and processorswithin digital section 1520. ROM 1532 may store a boot code and/or othercode and data for wireless device 1500. NAND Flash controller 1534 mayfacilitate transfer of data between a NAND Flash 1544 and digitalsection 1520. SDRAM controller 1536 may facilitate transfer of databetween a SDRAM 1546 and digital section 1520.

Secure module 1530 may securely store sensitive information (e.g.,personal information, business information, passwords, etc.) and/orother information for device 1500. Secure module 1530 may include anentropy source and/or RN generator 1540 to generate random values. RNgenerator 1540 may include a post-processing circuit to receive firstrandom values from entropy source 1540 and generate second randomvalues. Secure module 1530 may implement cryptographic algorithms thatmay use the random values generated by entropy source and/or RNgenerator 1540. Secure module 1530 may also provide random values toother modules within wireless device 1500. Other modules and processorswithin wireless device 1500 may also include entropy sources and/or RNgenerators to generate random values. Processors such as processor 1524may also include a RN generator (e.g., for software running on theprocessor to use).

In general, digital section 1520 may include any number of processing,interface, and memory modules. Digital section 1520 may also beimplemented with one or more digital signal processors (DSPs),micro-processors, RISC processors, etc. Digital section 1520 may befabricated on one or more application specific integrated circuits(ASICs) and/or some other type of integrated circuits (ICs).

Those of skill in the art would understand that information and signalsmay be represented using any of a variety of different technologies andtechniques. For example, data, instructions, commands, information,signals, bits, symbols, and chips that may be referenced throughout theabove description may be represented by voltages, currents,electromagnetic waves, magnetic fields or particles, optical fields orparticles, or any combination thereof.

Those of skill would further appreciate that the various illustrativelogical blocks, modules, circuits, and algorithm steps described inconnection with the disclosure herein may be implemented as electronichardware, computer software, or combinations of both. To clearlyillustrate this interchangeability of hardware and software, variousillustrative components, blocks, modules, circuits, and steps have beendescribed above generally in terms of their functionality. Whether suchfunctionality is implemented as hardware or software depends upon theparticular application and design constraints imposed on the overallsystem. Skilled artisans may implement the described functionality invarying ways for each particular application, but such implementationdecisions should not be interpreted as causing a departure from thescope of the present disclosure.

The various illustrative logical blocks, modules, and circuits describedin connection with the disclosure herein may be implemented or performedwith a general-purpose processor, a DSP, an ASIC, a field programmablegate array (FPGA) or other programmable logic device, discrete gate ortransistor logic, discrete hardware components, or any combinationthereof designed to perform the functions described herein. Ageneral-purpose processor may be a microprocessor, but in thealternative, the processor may be any conventional processor,controller, microcontroller, or state machine. A processor may also beimplemented as a combination of computing devices, e.g., a combinationof a DSP and a microprocessor, a plurality of microprocessors, one ormore microprocessors in conjunction with a DSP core, or any other suchconfiguration.

The steps of a method or algorithm described in connection with thedisclosure herein may be embodied directly in hardware, in a softwaremodule executed by a processor, or in a combination of the two. Asoftware module may reside in RAM memory, flash memory, ROM memory,EPROM memory, EEPROM memory, registers, hard disk, a removable disk, aCD-ROM, or any other form of storage medium known in the art. Anexemplary storage medium is coupled to the processor such that theprocessor can read information from, and write information to, thestorage medium. In the alternative, the storage medium may be integralto the processor. The processor and the storage medium may reside in anASIC. The ASIC may reside in a user terminal. In the alternative, theprocessor and the storage medium may reside as discrete components in auser terminal.

In one or more exemplary designs, the functions described may beimplemented in hardware, software, firmware, or any combination thereof.If implemented in software, the functions may be stored on ortransmitted over as one or more instructions or code on acomputer-readable medium. Computer-readable media includes both computerstorage media and communication media including any medium thatfacilitates transfer of a computer program from one place to another. Astorage media may be any available media that can be accessed by ageneral purpose or special purpose computer. By way of example, and notlimitation, such computer-readable media can comprise RAM, ROM, EEPROM,CD-ROM or other optical disk storage, magnetic disk storage or othermagnetic storage devices, or any other medium that can be used to carryor store desired program code means in the form of instructions or datastructures and that can be accessed by a general-purpose orspecial-purpose computer, or a general-purpose or special-purposeprocessor. Also, any connection is properly termed a computer-readablemedium. For example, if the software is transmitted from a website,server, or other remote source using a coaxial cable, fiber optic cable,twisted pair, digital subscriber line (DSL), or wireless technologiessuch as infrared, radio, and microwave, then the coaxial cable, fiberoptic cable, twisted pair, DSL, or wireless technologies such asinfrared, radio, and microwave are included in the definition of medium.Disk and disc, as used herein, includes compact disc (CD), laser disc,optical disc, digital versatile disc (DVD), floppy disk and blu-ray discwhere disks usually reproduce data magnetically, while discs reproducedata optically with lasers. Combinations of the above should also beincluded within the scope of computer-readable media.

The previous description of the disclosure is provided to enable anyperson skilled in the art to make or use the disclosure. Variousmodifications to the disclosure will be readily apparent to thoseskilled in the art, and the generic principles defined herein may beapplied to other variations without departing from the spirit or scopeof the disclosure. Thus, the disclosure is not intended to be limited tothe examples and designs described herein but is to be accorded thewidest scope consistent with the principles and novel features disclosedherein.

What is claimed is:
 1. An apparatus comprising: an entropy sourcecomprising at least one magneto-resistive (MR) element and configured toprovide first random values based on the at least one MR element; and apost-processing module configured to receive and process the firstrandom values and provide second random values.
 2. The apparatus ofclaim 1, wherein the post-processing module is configured to hash thefirst random values and provide the second random values.
 3. Theapparatus of claim 2, wherein the post-processing module is configuredto hash the first random values based on a cryptographic hash function.4. The apparatus of claim 1, wherein a total number of bits of eachsecond random value is greater than a total number of bits of all firstrandom values used to generate the second random value.
 5. The apparatusof claim 1, the post-processing module comprising: a plurality of shiftregisters configured to receive a plurality of sequences of first randomvalues from a plurality of entropy sources including the entropy source,and a hash module configured to receive a plurality of sequences ofintermediate values from the plurality of shift registers, hash theintermediate values, and provide the second random values.
 6. Theapparatus of claim 5, wherein each first random value comprises a 1-bitvalue, each intermediate value comprises a Q-bit value, and each secondrandom value comprises a N-bit value, where Q and N are each greaterthan one.
 7. The apparatus of claim 1, wherein the post-processingmodule is configured to generate the second random values based on thefirst random values and an error detection code.
 8. The apparatus ofclaim 7, wherein the error detection code comprises a cyclic redundancycheck (CRC).
 9. The apparatus of claim 1, the post-processing modulecomprising: a linear feedback shift register (LFSR) implementing agenerator polynomial and configured to receive the first random valuesand provide the second random values.
 10. The apparatus of claim 1, thepost-processing module comprising: a plurality of registers coupled inseries, and at least two combiners coupled to at least two registers inthe plurality of registers and configured to receive at least twosequences of first random values from at least two entropy sources, theplurality of registers and the at least two combiners implementing agenerator polynomial with at least two feedback bits, and the at leasttwo entropy sources including the entropy source.
 11. The apparatus ofclaim 1, the post-processing module comprising: an entropy accumulatorconfigured to receive the first random values and provide intermediaterandom values; and a cryptographic module configured to receive theintermediate random values and provide second random values.
 12. Theapparatus of claim 1, the post-processing module comprising: a combinerconfigured to receive and process a plurality of sequences of firstrandom values from a plurality of entropy sources and provide the secondrandom values, the plurality of entropy sources including the entropysource.
 13. The apparatus of claim 12, the combiner comprising anexclusive OR (XOR) circuit.
 14. The apparatus of claim 12, wherein thecombiner is configured to perform modulo-M summation of a plurality offirst random values in the plurality of sequences of first random valuesto obtain a corresponding second random value, where M is an integergreater than one.
 15. The apparatus of claim 1, the post-processingmodule comprising: a stream cipher generator configured to generate thesecond random values, the first random values altering operation orinternal state of the stream cipher generator.
 16. The apparatus ofclaim 15, wherein the stream cipher generator is configured to generatethe second random values based on a stream cipher algorithm, the firstrandom values selecting coefficients of the stream cipher algorithm. 17.The apparatus of claim 15, wherein the stream cipher generator isconfigured to generate the second random values based on a stream cipheralgorithm, the first random values changing the internal state of thestream cipher generator.
 18. The apparatus of claim 1, wherein the firstrandom values comprise 1-bit random values and the second random valuescomprise multi-bit random values.
 19. The apparatus of claim 1, theentropy source comprising: a biasing circuit configured to provide astatic current for the at least one MR element, and a sensing circuitconfigured to sense resistance of the at least one MR element andprovide random values based on the sensed resistance.
 20. The apparatusof claim Error! Reference source not found, the entropy sourcecomprising: a circuit configured to generate current or voltage pulsesto change a state of the at least one MR element, and a sensing circuitconfigured to sense resistance of the at least one MR element andprovide random values based on the sensed resistance.
 21. An apparatuscomprising: an array of magneto-resistive (MR) cells arranged in aplurality of rows and a plurality of columns, each MR cell comprising atleast one MR element; a plurality of word lines coupled to the pluralityof rows of MR cells; a plurality of select lines coupled to theplurality of columns of MR cells; a sensing circuit coupled to theplurality of select lines and configured to sense resistance of aselected MR cell in the array and provide random values; and a pluralityof programming sources coupled to the plurality of select lines andconfigured to provide pulses to change state of the MR cells in thearray, the plurality of programming sources including a firstprogramming source coupled to the selected MR cell when the selected MRcell is to be switched in a first direction, and a second programmingsource coupled to the selected MR cell when the selected MR cell is tobe switched in a second direction.
 22. The apparatus of claim 21,wherein the plurality of programming sources are configured to providecurrent pulses or voltage pulses to change the state of the MR cells inthe array.
 23. The apparatus of claim 21, wherein at least one of thefirst and second programming sources is configured to provide pulses ofa variable amplitude, or a variable pulse duration, or both a variableamplitude and a variable pulse duration determined based on a targetswitching probability of the selected MR cell.
 24. The apparatus ofclaim 21, wherein the plurality of programming sources have individuallyconfigured pulse amplitude, or pulse duration, or both pulse amplitudeand pulse duration.
 25. The apparatus of claim 21, wherein the selectedMR cell is programmed in a single operation and is applied with acurrent pulse or a voltage pulse from the first or second programmingsource in the single operation.
 26. The apparatus of claim 21, whereinthe selected MR cell is programmed in a plurality of operations and isapplied with a current pulse or a voltage pulse from the first or secondprogramming source in each of the plurality of operations.
 27. Theapparatus of claim 21, wherein the MR cells in the array are selectedand sensed at a first rate to generate random values at a second ratethat is higher than the first rate.
 28. The apparatus of claim 21,wherein each MR cell includes a plurality of MR elements coupled inseries.
 29. The apparatus of claim 21, wherein each MR cell includes aplurality of MR elements coupled in parallel.
 30. The apparatus of claim29, wherein the plurality of MR elements in each MR cell have freelayers that are coupled together and fixed layers that are also coupledtogether.
 31. The apparatus of claim 21, further comprising: at leastone MR cell used to provide a reference voltage for the sensing circuit.32. The apparatus of claim 21, wherein the MR cells in the arraycomprise MR elements of different shapes, or different sizes, ordifferent thickness, or a combination thereof.
 33. An apparatuscomprising: an entropy source comprising at least one magneto-resistive(MR) element and configured to provide first values based on the atleast one MR element; and a detection module configured to receive andprocess the first values and provide an indication of tampering with theentropy source.
 34. The apparatus of claim 33, wherein the detectionmodule is configured to detect tampering with the entropy source basedon percentage of zeros and percentage of ones in the first values. 35.The apparatus of claim 33, wherein the detection module is configured todetect tampering with the entropy source based on runs of zeros and runsof ones in the first values.
 36. The apparatus of claim 33, wherein thedetection module is configured to detect tampering with the entropysource based on number of occurrences of predetermined patterns of zerosand ones.
 37. The apparatus of claim 33, wherein the detection module isconfigured to perform compression of the first values and to detecttampering with the entropy source based on an output rate of thecompression.